3 ms·
Something somewhere is always hostile to particular group. That's just facts of life. You do your best to minimize but can never eliminate it. As someone who h
by stackskipton 1y ago
Something somewhere is always hostile to particular group. That's just facts of life. You do your best to minimize but can never eliminate it.
As someone who has dealt with 2FA support, all the methods suck.
SMS 2FA is least secure but has broadest support with quickest recovery method.
TOTP Applications (Google Auth, Authy, iOS Passwords) is more secure but people switch phones, lose phones and so forth and recovery is always a nightmare.
Yubikey and like have cost problem and you still have recovery problem.
A clear solution in my mind is having the Federal Government run some form of centralized hardware based system where hardware could be replaced by government office after verifying identity. Government does this already for DoD CaC cards. However, in the United States, Privacy Advocates would lose their minds, and funding would constantly be under attack.
So yea, I get SMS 2FA is hostile to mountain people but 2FA is hostile to login services and executive yachts.
- nine_k 1y ago> Privacy Advocates would lose their minds Privacy of authentication may be a valid concern (e.g. during voting), but I don't see how it applies here. If what I want is to confirm to the bank that I am who I am, with all the details about me that I have told the bank already anyway, I very clearly and openly forfeit my privacy. I explicitly ask to be precisely identified.
- pavon 1y agoFor banks an other cases that (1) need to know you true identity, and (2) provide no expectation of privacy regarding sharing the existence of accounts with the government, a government run authentication would be fine from a privacy point of view. The issue is that every site has moved to using 2FA, and most of them have no legitimate need to know your true identity. So using a government ID based solution would unnecessarily conflate authentication and identification and would be a real privacy concern.
- nine_k 1y agoCan you offer an example of a situation when the second factor authentifies without identification? Assume a service S wants a confirmation that user U is indeed legitimate. The centralized auth service A could receive from S a bunch of data S knows about U, like name, address, phone, SSN, whatever S needs to know about U. Then A should respond whether the fields match the data which A knows about U, without revealing to S any additional data that A may know about U. The problem if a centralized service is that it's a SPOF, and the juiciest target for compromising. I still think that TOTP and personal crypto tokens like yubikey are the most resilient, and technically the easiest, solution to that.
- deleted 1y ago[deleted]
- pavon 1y agoAny TOTP where the user enrolls it on account creation, without going through a third-party service. Or SMS on a burner phone. Both are pseudonymous, since using the same authentication at multiple sites could be linked, but neither have to be tied to a real-world identity.
- Hackbraten 1y ago> Yubikey and like have cost problem and you still have recovery problem. Recovery is relatively straightforward if you have more than one key. You enroll all your keys, and if you lose one, you buy a new key and use one of the other keys to enroll it.
- wkat4242 1y agoYes though you have to do that manually on every site you used it on. Not great once it becomes more supported.
- stackskipton 1y agoYea, users never do that.
- protocolture 1y ago>Government run some form of centralized Nah I am good thanks.
- snowwrestler 1y agoAny system in which the government can re-establish account access on my behalf is a system in which the government can access my account without my knowledge. No thank you. If you mean the government just replaces hardware and re-establishing access is up to me, that’s no different from Yubikey.
- stackskipton 1y agoIn most cases, they can just subpoena the system and get all your data that way. Probably get a judge to sign off on subpoena coming with hush clause.